Critical PHP Vulnerabilities Fixed After Global Coordination Led by OpenAI
OpenAI and security partners coordinated with the PHP maintainers to fix two critical remote code execution vulnerabilities, collectively known as PHP2Shell, affecting a vast majority of websites before public disclosure. Affecting an estimated 70% of websites worldwide, these high-severity flaws posed massive risks of unauthenticated remote code execution until emergency patches were released. The incident highlights both the defensive potential and risks of advanced AI models in vulnerability discovery. Tracked as CVE-2026-109618 and CVE-2026-109619 with CVSS v4.0 scores of 9.2, the vulnerabilities affect PHP versions 5.4 through 8.5. Emergency fixes were released in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
## BACKGROUND
PHP is a widely used open-source scripting language that powers a large portion of the web and backend applications. Remote code execution vulnerabilities allow malicious actors to run arbitrary commands on a server, potentially stealing data or taking complete control of the system.